Brave browser email aliases have arrived in version 1.94, giving users a way to hand over a disposable address when registering for a new service rather than exposing their actual inbox to whatever fate awaits that service’s database. It is a small feature with a pointed rationale: even a browser that isolates cookies and blocks cross-site tracking cannot stop a careless third party from leaking your email address to data brokers or phishing operators.
The mechanism is straightforward. A user creates a free Brave Account, registers their primary email address with it, and can then generate up to five aliases at no cost. Each alias forwards incoming messages to the real address while keeping that address invisible to the sender. Aliases can carry local notes; if a user opts into Brave Sync, those notes travel end-to-end encrypted. Messages themselves are deleted from Brave’s servers within seconds of delivery, and automated spam and malware filtering is the only inspection they receive in transit.
Why Email Remains a Privacy Weak Spot in Brave Browser Email Aliases
Brave has long used data isolation to prevent websites from correlating users across sessions through cookies or cached content. But email addresses sit on external servers, outside that isolation layer entirely. ‘If a website you signed up for is hacked, your information can be leaked and end up with data brokers or worse,’ Brave says in its announcement. ‘Your email address then circulates far beyond the company you originally trusted with it, and can show up in phishing campaigns for years afterward.’ The alias system cuts that chain: a breached alias can simply be deleted, leaving the real address untouched.
Brave also warns that forwarded messages may initially land in recipients’ spam folders while it builds its reputation as a sending domain. Anyone testing the feature should check their junk folder during the early period.
On the infrastructure side, the Brave Help Center confirms that the Email Aliases feature runs on Amazon Web Services. That is worth noting for users whose threat model includes cloud-provider-level visibility, though message deletion within seconds of delivery limits the window of exposure considerably.
OPAQUE Authentication and the Engineering Team Behind the Feature
Account authentication for the alias system relies on OPAQUE, a password-authenticated key exchange protocol. Brave explains that OPAQUE authenticates users without transmitting passwords or their hashes to Brave’s servers, which reduces exposure to password logging, memory-scraping attacks, and bulk cracking of leaked password databases. The protocol does not protect against phishing or weak passwords, Brave is careful to note. According to Cyber Insider, OPAQUE was standardised as RFC 9807 in July 2025, making the Email Aliases feature one of the first consumer products to ship with it baked in.
A Brave Account is free and separate from a Brave Premium subscription. The primary address stored against the account, along with the generated aliases, is held in an encrypted state on Brave’s side.
The engineers who built the feature are named by Cyber Security News: Pavel Beloborodov, Tarik Demirović, and Harold Spencer Jr. handled engineering, DesignOps Lead Agustín Ruiz contributed on the design side, and former Brave privacy engineer Arthur Edelstein also played a part. The involvement of Edelstein, who worked on privacy architecture at Brave before departing, gives the feature some lineage in the browser’s longer history of anti-tracking work.
What Comes Next for Brave Browser Email Aliases
The five-alias cap on the free tier is a deliberate constraint: Brave says it plans to introduce a paid Premium tier later that will lift the restriction entirely. No pricing or timeline has been announced beyond that. For users who rotate through many services or want to segment their online activity more granularly, the current limit will feel tight, but the free tier is functional enough for everyday use cases such as newsletter sign-ups or one-off account registrations.
Brave 1.94 is available now, and the Email Aliases feature is accessible once users create or log into a Brave Account and register their primary address.
